@blamejs/core 0.17.18 → 0.17.20

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.17.x
 
+- v0.17.20 (2026-07-24) — **`b.forms.validate` enforces required checkboxes server-side and rejects malformed field bounds, closing two validation gaps.** b.forms.validate previously let an unchecked required checkbox pass: the renderer emits the HTML `required` attribute for it, but the server-side validator skipped the check, so a client that omitted the box -- or any non-browser caller -- bypassed a constraint the form advertised. It now rejects an unchecked required checkbox, keeping backend validation in lock-step with what the form displays. Separately, a field whose numeric bound (min/max/minlength/maxlength) was not a finite number went silently unenforced -- a NaN comparison is always false -- so the bound became a no-op; validate now throws on such a spec at the entry point, the same way it already rejects a non-precompiled regex pattern. Two smaller fixes: a field rendered without an explicit type now emits type="text" (matching the widget it dispatches to) rather than an empty type attribute, and b.externalDb reports EXPLAIN statements as row-returning so a query plan's rows are not dropped by the local-execution row/no-row chooser. **Changed:** *b.forms.validate option reference corrected* — The validate() reference described length bounds as minLength/maxLength, but the option keys are the HTML-attribute spellings minlength/maxlength (the same keys the renderer reads); the reference and its example are corrected, and the example now uses a numeric min bound on its number field. · *Vendored Public Suffix List refreshed to the current snapshot* — The bundled Public Suffix List that backs domain classification (registrable-domain and public-suffix checks in URL, cookie, and SSRF handling) is updated to the latest upstream publicsuffix.org snapshot, so newly delegated public suffixes and private-domain entries are recognized. **Fixed:** *Required checkboxes are enforced server-side in b.forms.validate* — A checkbox marked required is rendered with the HTML `required` attribute, but validate() treated an unchecked box (which coerces to false) as satisfying the field, so an unchecked required checkbox passed. Any caller that skipped the box -- a scripted client, or a browser with the constraint stripped -- bypassed a documented requirement. validate() now returns an error for an unchecked required checkbox (honouring the field's errorMessages.required), so the backend enforces the same constraint the frontend shows. A form that relied on the previous pass-through for an unchecked required checkbox will now surface a validation error, which is the intended behaviour. · *A malformed numeric field bound is rejected instead of silently ignored* — When a field's min, max, minlength, or maxlength was not a finite number (a non-numeric string, NaN, or Infinity), its comparison could never fire -- a NaN comparison is always false -- so the bound was quietly unenforced while appearing to constrain the field. validate() now throws at the entry point when a defined bound is non-finite, matching how it already requires pattern to be a pre-compiled RegExp. Numeric-string bounds (e.g. min: "1") remain accepted. · *A typeless field renders type="text" instead of an empty type attribute* — b.forms.render dispatches a field with no explicit type to a text input, but the emitted markup carried type="" rather than type="text". The rendered type attribute now matches the widget dispatched, so the markup is self-consistent. · *b.externalDb reports EXPLAIN statements as row-returning* — statementReturnsRows classified a plain EXPLAIN (and an EXPLAIN ANALYZE wrapping a write) as producing no row set, so the local-execution path could route it to a no-row call and drop the query plan. EXPLAIN always returns plan rows to the caller; it is now reported as row-returning whenever its prefix resolves, while an unparseable EXPLAIN prefix stays fail-closed. This is distinct from the cross-border residency read/write classification, which is unchanged.
+
+- v0.17.19 (2026-07-24) — **The error and adversarial paths of the sanctions-screening, JSON Schema, and HTTP client primitives are now under test.** This release adds no behaviour change. The fail-closed error paths, boundary conditions, and adversarial-input handling of b.complianceSanctions, b.jsonSchema, and b.httpClient -- previously exercised only on their happy paths -- are now asserted, verifying that each rejects malformed input, unresolvable references, and edge cases the documented contract already promised. No defects were found; the primitives behaved as specified. Genuinely-unreachable defensive fallbacks are documented rather than contorted into coverage. **Changed:** *Verified error-path behaviour for sanctions screening, JSON Schema, and the HTTP client* — The sanctions-screening list parsers (OFAC SDN/alias, EU CSL, UN 1267), the fuzzy/exact match strategy toggle, and the entry normalizer; the JSON Schema $ref/$dynamicRef resolution, JSON-pointer traversal, format assertions, and unevaluated-properties/items handling; and the HTTP client's error, redirect, and stream branches now have explicit tests for their failure and boundary behaviour. Behaviour is unchanged -- these assert guarantees the primitives already met -- so no migration is needed; the value is regression protection for the fail-closed paths of security-relevant primitives.
+
 - v0.17.18 (2026-07-24) — **`b.i18n` validates every inline translation tree at boot, closing a path where t() could return undefined.** b.i18n.create validated the translation trees only for the locales listed in the configured locales array. A locale present in the inline translations map but absent from locales is still reachable through an explicit t(key, vars, { locale }) override, and its tree escaped validation: a plural entry there missing the mandatory CLDR 'other' category made t() with a count return undefined instead of the key -- a contract violation that could render the literal string 'undefined' into server-rendered HTML or crash a downstream length/escape. Every inline translation tree is now validated at create, so a malformed one fails closed at boot rather than at the first request that reaches it. **Fixed:** *Every inline translation tree is validated at create, not only the configured locales* — b.i18n.create walked only opts.locales when validating translation trees up front, so a locale that appears in opts.translations but not in opts.locales was never checked even though it is reachable via an explicit locale override on t()/has(). A plural entry in such a tree that omits the mandatory 'other' category caused t(key, { count }) to select 'other', find nothing, and return undefined -- violating the documented contract that t() returns a string (the key on a miss) and never a non-string. create now validates every key of opts.translations, so a malformed tree is rejected at boot regardless of whether its locale is in opts.locales.
 
 - v0.17.17 (2026-07-23) — **Three verifier hardening fixes: timestamp trust anchors are required by default, OIDC id_token verification requires a configured issuer, and ed25519 DKIM uses the RFC 8463 raw-key format.** An audit of the signature-verifier surface found three verifiers that accepted or rejected the wrong thing. b.tsa.verifyToken authenticated a timestamp against a certificate embedded in the token itself and only ran the trust-anchor chain when the caller supplied one, so a self-signed token carrying the timestamping EKU was accepted as a valid timestamp; trust anchors are now required by default. b.auth.oauth's verifyIdToken skipped the CVE-2026-23552 cross-realm iss check entirely when the client was created without an issuer, so any OIDC id_token verified regardless of its issuer; an OIDC client must now be configured with an issuer to verify id_tokens. And the ed25519 DKIM verifier could not read the RFC 8463 raw 32-byte key format that every conformant sender publishes -- while the framework's own bootstrap published the non-standard SPKI form -- so ed25519, the default DKIM algorithm, was non-interoperable in both directions. **Fixed:** *ed25519 DKIM uses the RFC 8463 raw-key format on both sign and verify* — RFC 8463 §3-4 publishes an ed25519 DKIM public key as the raw 32-byte key, base64'd -- the form every conformant sender uses -- but the verifier wrapped that raw key in SubjectPublicKeyInfo PEM markers, which is not valid SPKI, so createPublicKey threw and a valid ed25519 signature returned permerror. Compounding it, b.mail.dkim.bootstrap published the key as SPKI DER (60 base64 chars) instead of the raw form (44 chars), so the framework's own default-algorithm signatures would not verify at a conformant receiver. The verifier now accepts a raw 32-byte key (wrapping it in the ed25519 SPKI header) and bootstrap publishes the raw key; RSA is unchanged. The same raw-key handling is applied on the ARC (b.mail.arc.verify) message-signature path. **Security:** *Timestamp verification requires a trust anchor by default* — b.tsa.verifyToken verified an RFC 3161 timestamp against the signer certificate embedded in the token -- which is attacker-controlled -- and ran the certificate-chain / trust-anchor check only when the caller passed trustAnchorsPem. With it omitted, a token whose self-signed leaf carried a critical, sole id-kp-timeStamping EKU was accepted as a valid timestamp: a forged proof that data existed at an arbitrary time (RFC 3161 §2.4.2 requires a trusted TSA). trustAnchorsPem is now required by default; an operator who deliberately wants trust-anchor-free verification sets allowUntrustedIssuer:true and the result carries issuerTrusted:false so the unauthenticated posture is visible (mirrors b.mdoc.verifyIssuerSigned). · *OIDC id_token verification requires a configured issuer* — b.auth.oauth.verifyIdToken wrapped the expected-issuer comparison -- the CVE-2026-23552 cross-realm / cross-issuer defense -- in a check that ran only when the client was configured with an issuer. An OIDC client (the default) created without an issuer therefore accepted an id_token with any iss, or none, as long as the signature, aud, and exp were valid: exactly the cross-realm acceptance the verifier exists to close, dangerous against a shared-signing-key multi-tenant OP. verifyIdToken now refuses to verify an OIDC id_token when no expected issuer is configured (OIDC Core §3.1.3.7); pass issuer to b.auth.oauth.create().

package/NOTICE

@@ -90,7 +90,7 @@ Used for:    Top-10000 most-common (breach-derived) passwords. Loaded by
              baseline.
 --------------------------------------------------------------------------------
 Component:   publicsuffix-list (Mozilla Public Suffix List)
-Version:     master snapshot (bundled 2026-07-23)
+Version:     master snapshot (bundled 2026-07-24)
 Source:      https://publicsuffix.org/list/public_suffix_list.dat
 License:     MPL-2.0
 Copyright:   Copyright (c) Mozilla Foundation and Public Suffix List contributors

package/lib/external-db.js

@@ -381,6 +381,18 @@ var _ROW_RETURNING_CLASS = Object.freeze({ SELECT: true, READ_INFO: true });
 
 function statementReturnsRows(sql) {
   if (typeof sql !== "string" || sql.length === 0) return false;
+  // EXPLAIN — with or without ANALYZE, wrapping any inner statement —
+  // always returns a plan row set to the caller: `EXPLAIN ANALYZE INSERT`
+  // executes the write AND yields the plan. That is the row-set question,
+  // orthogonal to the residency gate's read/write class (where a plain
+  // EXPLAIN is a read and EXPLAIN ANALYZE <write> is a write). An EXPLAIN
+  // prefix that does not resolve (no inner statement, unbalanced option
+  // parens, unterminated span) stays fail-closed false so the .all()/.run()
+  // chooser never mis-routes an unparseable statement.
+  var m = _STATEMENT_CLASS_RE.exec(sql);
+  if (m && m[1].toUpperCase() === "EXPLAIN") {
+    return _explainResolve(sql, m.index + m[0].length) !== null;
+  }
   if (_ROW_RETURNING_CLASS[_classifyStatement(sql)] === true) return true;
   return _hasTopLevelReturning(sql);
 }

package/lib/forms.js

@@ -178,8 +178,11 @@ var INPUT_TYPES = {
 };
 
 function _renderInput(field) {
+  // A field with no explicit type defaults to a text input — mirror the
+  // `|| "text"` dispatch in _renderField so the emitted type attribute
+  // agrees with the widget actually rendered (never a bare type="").
   var attrs = [
-    'type="' + escapeAttribute(field.type) + '"',
+    'type="' + escapeAttribute(field.type || "text") + '"',
     'name="' + escapeAttribute(field.name) + '"',
   ];
   if (field.value !== undefined && field.value !== null) {
@@ -358,7 +361,14 @@ function _coerce(field, raw) {
   // (false), not "not provided." Coerce to false BEFORE the generic
   // undefined-passthrough below.
   if (field.type === "checkbox") {
-    if (raw === undefined || raw === null || raw === "" || raw === "false" || raw === "0") return false;
+    // A urlencoded checkbox submits its VALUE string only when checked, so
+    // any present string — including a custom value of "false" / "0" / "" —
+    // means checked: presence, not the string content, is the checked
+    // signal. Unchecked is the field's ABSENCE (undefined / null) or, for a
+    // typed (JSON) body, an explicit boolean false / numeric 0. This keeps a
+    // required checkbox satisfiable whatever value it is rendered with, while
+    // a JSON false / 0 still reads as unchecked.
+    if (raw === undefined || raw === null || raw === false || raw === 0) return false;
     return true;
   }
   if (raw === undefined) return undefined;
@@ -381,6 +391,74 @@ function _isEmpty(v) {
   return v === undefined || v === null || v === "";
 }
 
+// A field's numeric bound (min / max / minlength / maxlength) must resolve
+// to a finite number. A non-finite bound (a non-numeric string, NaN,
+// Infinity) would make its comparison a silent no-op — NaN comparisons are
+// always false — turning a documented constraint into nothing. That is an
+// operator config error, so throw at the entry point (mirrors the
+// pre-compiled-RegExp requirement for `pattern`) rather than shipping a
+// form whose bound is quietly unenforced.
+// A clean numeric literal: an optional sign, an integer/decimal mantissa,
+// and an optional exponent. Linear (no nested quantifier over overlapping
+// classes), so it is a framework-internal constant with no ReDoS surface.
+var NUMERIC_LITERAL_RE = /^[+-]?(?:\d+\.?\d*|\.\d+)(?:[eE][+-]?\d+)?$/;
+// Any real numeric bound is short — Number.MAX_VALUE stringifies to ~23
+// chars — so cap the length before the regex test; a longer "number" string
+// is malformed, and running a regex over an unbounded operator string is a
+// DoS shape regardless of the pattern's own linearity.
+var MAX_NUMERIC_BOUND_CHARS = 40;
+
+function _numericBound(f, key) {
+  var v = f[key];
+  // Accept ONLY a genuine finite number or a string that is a clean numeric
+  // literal. A bare Number() coerces null / "" / whitespace / false / [] to a
+  // finite 0 (and true to 1), which would let a malformed bound — e.g.
+  // min: null, which the renderer emits as min="" (no constraint) — silently
+  // validate as 0 on the backend and diverge from the browser. Those are
+  // rejected here, not coerced.
+  var n = NaN;
+  if (typeof v === "number") n = v;
+  else if (typeof v === "string" && v.length <= MAX_NUMERIC_BOUND_CHARS && NUMERIC_LITERAL_RE.test(v)) n = Number(v);
+  if (!Number.isFinite(n)) {
+    throw new Error("forms.validate: field '" + f.name + "'." + key +
+      " must be a finite number; got " +
+      (typeof v === "string" ? JSON.stringify(v) : typeof v) +
+      ". Fix the form spec.");
+  }
+  return n;
+}
+
+// Validate a field's SPEC — the operator-supplied shape, independent of any
+// submitted value. A numeric bound (min / max / minlength / maxlength) must
+// be finite, and a `pattern` must be a pre-compiled, ReDoS-safe RegExp
+// (compiling operator source on the request path would be an engine ReDoS
+// surface). A malformed spec is an operator config error surfaced
+// deterministically at the entry point — never conditionally on whether a
+// given request happens to carry a value that reaches the bound, which would
+// turn a config bug into an input-dependent runtime failure.
+function _assertFieldSpec(f) {
+  if (!f.name || f.type === "submit") return;
+  // min / max are compared numerically only for number / range controls;
+  // date / time / datetime-local / month / week controls carry ISO-string
+  // bounds (e.g. min: "2026-01-01") that validate() never compares
+  // numerically, so those are not numeric bounds and must not be rejected.
+  if (f.type === "number" || f.type === "range") {
+    if (f.min !== undefined) _numericBound(f, "min");
+    if (f.max !== undefined) _numericBound(f, "max");
+  }
+  // minlength / maxlength are always character counts, whatever the control.
+  if (f.minlength !== undefined) _numericBound(f, "minlength");
+  if (f.maxlength !== undefined) _numericBound(f, "maxlength");
+  if (f.pattern) {
+    if (!(f.pattern instanceof RegExp)) {
+      throw new Error("forms.validate: field '" + f.name +
+        "'.pattern must be a pre-compiled RegExp; got " +
+        (typeof f.pattern) + ". Wrap the source string with `RegExp` at config time.");
+    }
+    guardRegex.assertSafe(f.pattern, "forms: field[" + f.name + "].pattern");
+  }
+}
+
 /**
  * @primitive b.forms.validate
  * @signature b.forms.validate(spec, body)
@@ -390,8 +468,9 @@ function _isEmpty(v) {
  *
  * Walks the same spec the renderer accepts and validates a submitted
  * body. Per field: required-field check, type coercion (string /
- * number / boolean / email / url), `minLength` / `maxLength` bounds,
- * regex `pattern`, `enum` membership. Returns
+ * number / boolean / email / url), `minlength` / `maxlength` bounds,
+ * numeric `min` / `max` bounds, regex `pattern`, `enum` membership.
+ * Returns
  * `{ valid: boolean, errors: { field: msg, ... }, values: { ... } }`.
  * The `values` object holds coerced values keyed by field name —
  * route handlers consume `result.values` directly without re-parsing.
@@ -400,7 +479,7 @@ function _isEmpty(v) {
  *   var result = b.forms.validate(
  *     { fields: [
  *         { type: "email",  name: "email", required: true },
- *         { type: "number", name: "age",   minLength: 1 },
+ *         { type: "number", name: "age",   min: 1 },
  *     ] },
  *     { email: "ada@example.com", age: "37" }
  *   );
@@ -410,6 +489,12 @@ function validate(spec, body) {
   if (!spec || !Array.isArray(spec.fields)) {
     throw new Error("forms.validate: spec.fields must be an array");
   }
+  // Validate every field's spec up front — a malformed bound or pattern is
+  // rejected on the first call, deterministically, regardless of the body
+  // (never only when a request happens to carry a value that reaches it).
+  for (var s = 0; s < spec.fields.length; s++) {
+    _assertFieldSpec(spec.fields[s]);
+  }
   body = body || {};
   var errors = {};
   var values = {};
@@ -423,7 +508,21 @@ function validate(spec, body) {
     var coerced = _coerce(f, raw);
     values[f.name] = coerced;
 
-    if (f.required && _isEmpty(coerced) && coerced !== false) {
+    // Checkbox: the only constraint is `required`, which HTML defines as
+    // "must be checked" — and the renderer emits that attribute, so the
+    // server enforces the same (backend validates what the frontend
+    // displays). An unchecked required box (coerced === false) is an error,
+    // never a silent pass. No length / pattern / enum checks apply.
+    if (f.type === "checkbox") {
+      if (f.required && coerced !== true) {
+        errors[f.name] = f.errorMessages && f.errorMessages.required
+          ? f.errorMessages.required
+          : (f.label || f.name) + " is required";
+      }
+      continue;
+    }
+
+    if (f.required && _isEmpty(coerced)) {
       errors[f.name] = f.errorMessages && f.errorMessages.required
         ? f.errorMessages.required
         : (f.label || f.name) + " is required";
@@ -486,27 +585,14 @@ function validate(spec, body) {
         errors[f.name] = (f.label || f.name) + " must be at most " + f.maxlength + " characters";
         continue;
       }
-      if (f.pattern) {
-        // Pattern accepts a pre-compiled RegExp only — taking a string
-        // and compiling it here would be a ReDoS surface against the
-        // form-render engine. Operators construct the RegExp at config
-        // time so the framework never compiles operator-supplied source
-        // on the request path.
-        if (!(f.pattern instanceof RegExp)) {
-          throw new Error("forms.validate: field '" + f.name +
-            "'.pattern must be a pre-compiled RegExp; got " +
-            (typeof f.pattern) + ". Wrap the source string with `RegExp` at config time.");
-        }
-        // Screen the operator-supplied pattern for catastrophic-backtracking
-        // (ReDoS) shapes before the test, so a pathological regex can't be
-        // run against the submitted value.
-        guardRegex.assertSafe(f.pattern, "forms: field[" + f.name + "].pattern");
-        if (!f.pattern.test(coerced)) {
-          errors[f.name] = f.errorMessages && f.errorMessages.pattern
-            ? f.errorMessages.pattern
-            : (f.label || f.name) + " has an invalid format";
-          continue;
-        }
+      // `pattern` was proven a pre-compiled, ReDoS-safe RegExp by the
+      // up-front spec pass, so only the match against the submitted value
+      // remains on the request path.
+      if (f.pattern && !f.pattern.test(coerced)) {
+        errors[f.name] = f.errorMessages && f.errorMessages.pattern
+          ? f.errorMessages.pattern
+          : (f.label || f.name) + " has an invalid format";
+        continue;
       }
     }
     if ((f.type === "select" || f.type === "radio") && Array.isArray(f.options)) {

package/lib/vendor/MANIFEST.json

@@ -18,7 +18,7 @@
       "hashes": {
         "server": "sha256:2b30a26f728c5349f4c4b47834f862a4f77393b1224fc12b22abe3ce2cfab78f"
       },
-      "refreshedAt": "2026-07-23T22:29:23.692Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "@noble/curves": {
       "version": "2.2.0",
@@ -40,7 +40,7 @@
       "hashes": {
         "server": "sha256:2880c288b1285ef51d356d057bee6f0c8a00de36638cf47b47617e8c1faf10d5"
       },
-      "refreshedAt": "2026-07-23T22:29:23.692Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9c94094b3c10fe73dac5343289da582454ea6053494fab2bf66099d9103d6c3"
       },
-      "refreshedAt": "2026-07-23T22:29:23.692Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.2",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:e83195dc9f189385da9c856ef38843f4466f93ea8f3d7fc2efcb1e1b18da6f20"
       },
-      "refreshedAt": "2026-07-23T22:29:23.692Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-23T22:29:23.692Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-23T22:29:23.692Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -152,14 +152,14 @@
         "data_js": "lib/vendor/public-suffix-list.data.js"
       },
       "bundler": "curl https://publicsuffix.org/list/public_suffix_list.dat",
-      "bundledAt": "2026-07-23T00:00:00Z",
+      "bundledAt": "2026-07-24T00:00:00Z",
       "hashes": {
-        "server": "sha256:04220f6e1c20c9af1edfcd891dd4663b2c92a020b13e698dd13b3630573520ca",
-        "data_js": "sha256:52428436de68a79537db52f2b0cb7ac0a1cc3e6397db87533c6e2f1bd2e12087"
+        "server": "sha256:1fc04fd8ebd4b77c78c38c76d832673c27b56ca154fda6339be61f38b9918701",
+        "data_js": "sha256:1d17ee3059030d1de7208d699ffdd1595c97cd3009d1f41bbfde2ba1a3315372"
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-23T22:29:23.692Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "peculiar-pki": {
       "version": "2.0.0+pkijs-3.4.0",
@@ -190,7 +190,7 @@
       "hashes": {
         "server": "sha256:2307ef65e070757ffb13442b377e45efb9fa1a10432d9b39618387720ab990ed"
       },
-      "refreshedAt": "2026-07-23T22:29:23.692Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     }
   }
 }

package/lib/vendor/public-suffix-list.dat

@@ -5,8 +5,8 @@
 // Please pull this list from, and only from https://publicsuffix.org/list/public_suffix_list.dat,
 // rather than any other VCS sites. Pulling from any other URL is not guaranteed to be supported.
 
-// VERSION: 2026-07-23_18-24-27_UTC
-// COMMIT: 93b4eb174b2da9ee3f6effc363b579a96a65c93a
+// VERSION: 2026-07-24_16-56-26_UTC
+// COMMIT: f85a38e61c222ea2d9901a41296c6c74fd3e2c28
 
 // Instructions on pulling and using this list can be found at https://publicsuffix.org/list/.
 
@@ -6838,7 +6838,7 @@ org.zw
 
 // newGTLDs
 
-// List of new gTLDs imported from https://www.icann.org/resources/registries/gtlds/v2/gtlds.json on 2026-07-15T16:20:56Z
+// List of new gTLDs imported from https://www.icann.org/resources/registries/gtlds/v2/gtlds.json on 2026-07-24T16:40:16Z
 // This list is auto-generated, don't edit it manually.
 // aaa : American Automobile Association, Inc.
 // https://www.iana.org/domains/root/db/aaa.html
@@ -10732,6 +10732,10 @@ weather
 // https://www.iana.org/domains/root/db/weatherchannel.html
 weatherchannel
 
+// web : VeriSign, Inc.
+// https://www.iana.org/domains/root/db/web.html
+web
+
 // webcam : dot Webcam Limited
 // https://www.iana.org/domains/root/db/webcam.html
 webcam